[AArch64] __builtin_return_address for PAuth.

[danielkiss]

Summary

This change adds the support for __builtin_return_address
for ARMv8.3A Pointer Authentication.
Location of the authentication code in the pointer depends on
the system configuration, therefore a dedicated instruction is used for
effectively removing the authentication code without
authenticating the pointer.

[danielkiss]

clang/test/CodeGen/arm64-extractreturnaddress.c

15 ↗

(On Diff #246183)

CHECK-NEXT: entry:
CHECK-NEXT: ret i8* inttoptr (i64 42 to i8*)

16 ↗

(On Diff #246183)

CHECK-PAC: %0 = call i8* @llvm.extractreturnaddress.p0i8.p0i8(i8* inttoptr (i64 42 to i8*))
CHECK-PAC83: %0 = call i8* @llvm.extractreturnaddress.p0i8.p0i8(i8* inttoptr (i64 42 to i8*))
CHECK-BPROT8: %0 = call i8* @llvm.extractreturnaddress.p0i8.p0i8(i8* inttoptr (i64 42 to i8*))
CHECK-BPROT83: %0 = call i8* @llvm.extractreturnaddress.p0i8.p0i8(i8* inttoptr (i64 42 to i8*))

[danielkiss]

rebased and test is updated.

[danielkiss]

Rebased.

[chill]

Needs a test in clang/test that __builtin_extract_return_address is translated to llvm.extractreturnaddress.

What if LLVM IR contains a call to llvm.extractreturnaddress, but the target is not AArch64?

llvm/include/llvm/CodeGen/ISDOpcodes.h

491–492

Needs a comment about EXTRACTRETURNADDR. And also a slightly different grouping, so the non-commented/undocumented things stand out.

[chill]

clang/lib/CodeGen/TargetInfo.cpp

5151 ↗

(On Diff #254921)

Can drop the extra braces here.

5156 ↗

(On Diff #254921)

Is this necessary, the intrinsic already has IntrNoMem?

[chill]

In D75044#1966997, @chill wrote:

Needs a test in clang/test that __builtin_extract_return_address is translated to llvm.extractreturnaddress.

Nevermind, I'm blind.

[danielkiss]

Rebased and address review comments.

[danielkiss]

llvm/include/llvm/CodeGen/ISDOpcodes.h

491–492

agree, I. added documentation for all now.

[danielkiss]

Changing the implementation from builtin_extract_return_addr to builtin_return_address.
Stripping PAC in __builtin_return_address is a better solution, because:

• we should not expose PAC bits to the user because it could be passed around and that would be an ABI break.
• builtin_extract_return_addr has a pair, the builtin_frob_return_addr which won't be supported with PAC.

I'm thinking of adding a warning if __builtin_frob_return_addr is used with PAC on.
Same change will be proposed from gcc too.

[danielkiss]

Related ticket for gcc: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94891

[danielkiss]

patch for gcc: https://gcc.gnu.org/pipermail/gcc-patches/2020-June/547404.html

[danielkiss]

Patch for gcc is merged. https://gcc.gnu.org/git/?p=gcc.git;a=commitdiff;h=a70d5d81c41048556fd86eaa1036018a6bfba115

[chill]

I'm afraid the patch does not work yet. For example, when the following program

void *f() {
	void g();
	g();
	return __builtin_return_address(0);
}

is compiled with

./bin/clang -target aarch64-eabi -march=armv8.3-a  -mbranch-protection=pac-ret -S -O2 h.c

The issue is that the definition of the instructions XPAC{D,I} is incorrect: it does not mention at all the operand to those insns.
Another problem is that the patch does not work with -O0. When compiling without optimisations, AArch64 backend used GlobalISel.

I have patches for these two issues. I'll post the one for XPAC{D,I} tomorrow and perhaps in a couple of days the GlobalISel one and we're good to go.

llvm/lib/Target/AArch64/AArch64ISelLowering.cpp

6495

We shouldn't be hardcoding the X0 register here. We already have the encoded return address in ReturnAddress
can simply do:

SDNode *St = DAG.getMachineNode(AArch64::XPACI, DL, VT, ReturnAddress);

6500

Rename Reg to Chain.

[chill]

In D75044#2165496, @chill wrote:

The issue is that the definition of the instructions XPAC{D,I} is incorrect: it does not mention at all the operand to those insns.

Err, they do mention the operand, but only as an input one, it should be input/output.

[danielkiss]

fix review comments.

[chill]

LGTM. Thanks!

[chill]

Let's postpone this just for a little bit, to settle on an approach to depth > 0.

[chill]

In D75044#2186973, @chill wrote:

Let's postpone this just for a little bit, to settle on an approach to depth > 0.

This is with regard to https://reviews.llvm.org/D84502#inline-779900

[danielkiss]

Always emit xpac* instructions as discussed in D84502.

[danielkiss]

updating tests too. check-llvm, check-clang passes.

[danielkiss]

@chill Could you check the latest update? I think it should be submitted with D84502 together.

[danielkiss]

@chill ping.

[chill]

In D75044#2292302, @danielkiss wrote:

@chill ping.

Sorry, I thought about committing all PAC/BTI patches together, but there's no reason, is there?
So, let's go ahead and commit the two dealing with __builtin-return_address .

llvm/include/llvm/CodeGen/ISDOpcodes.h

enum NodeType {
 
   /// FRAMEADDR, RETURNADDR - These nodes represent llvm.frameaddress and
   /// llvm.returnaddress on the DAG.  These nodes take one operand, the index
   /// of the frame or return address to return.  An index of zero corresponds
   /// to the current function's frame or return address, an index of one to
   /// the parent's frame or return address, and so on.
   FRAMEADDR,
   RETURNADDR,
+
+  /// ADDROFRETURNADDR - Represents the llvm.addressofreturnaddress intrinsic.
+  /// This node takes no operand, returns a target-specific pointer to the
+  /// place in the stack frame where the return address of the current
+  /// function is stored.
   ADDROFRETURNADDR,
+
+  /// SPONENTRY - Represents the llvm.sponentry intrinsic. Takes no argument
+  /// and returns the stack pointer value at the entry of the current
+  /// function calling this intrinsic.
   SPONENTRY,
 
   /// LOCAL_RECOVER - Represents the llvm.localrecover intrinsic.
   /// Materializes the offset from the local object pointer of another
   /// function to a particular local object passed to llvm.localescape. The
   /// operand is the MCSymbol label used to represent this offset, since
   /// typically the offset is not known until after code generation of the
   /// parent.
enum NodeType {
   /// VECTOR.
   INSERT_VECTOR_ELT,
 
   /// EXTRACT_VECTOR_ELT(VECTOR, IDX) - Returns a single element from VECTOR
   /// identified by the (potentially variable) element number IDX. If the return
   /// type is an integer type larger than the element type of the vector, the
   /// result is extended to the width of the return type. In that case, the high
   /// bits are undefined.
   ///
   /// If VECTOR is a scalable vector, then IDX may be larger than the minimum
   /// vector width. IDX is not first scaled by the runtime scaling factor of
   /// VECTOR.
   EXTRACT_VECTOR_ELT,
 
   /// CONCAT_VECTORS(VECTOR0, VECTOR1, ...) - Given a number of values of
   /// vector type with the same length and element type, this produces a
   /// concatenated vector result value, with length equal to the sum of the
   /// lengths of the input vectors. If VECTOR0 is a fixed-width vector, then

llvm/lib/Target/AArch64/AArch64ISelLowering.cpp

SDValue AArch64TargetLowering::LowerRETURNADDR(SDValue Op,
                                                SelectionDAG &DAG) const {
   MachineFunction &MF = DAG.getMachineFunction();
   MachineFrameInfo &MFI = MF.getFrameInfo();
   MFI.setReturnAddressIsTaken(true);
 
   EVT VT = Op.getValueType();
   SDLoc DL(Op);
   unsigned Depth = cast<ConstantSDNode>(Op.getOperand(0))->getZExtValue();
+  SDValue ReturnAddress;
   if (Depth) {
     SDValue FrameAddr = LowerFRAMEADDR(Op, DAG);
     SDValue Offset = DAG.getConstant(8, DL, getPointerTy(DAG.getDataLayout()));
-    return DAG.getLoad(VT, DL, DAG.getEntryNode(),
-                       DAG.getNode(ISD::ADD, DL, VT, FrameAddr, Offset),
-                       MachinePointerInfo());
+    ReturnAddress = DAG.getLoad(
+        VT, DL, DAG.getEntryNode(),
+        DAG.getNode(ISD::ADD, DL, VT, FrameAddr, Offset), MachinePointerInfo());
+  } else {
+    // Return LR, which contains the return address. Mark it an implicit
+    // live-in.
+    unsigned Reg = MF.addLiveIn(AArch64::LR, &AArch64::GPR64RegClass);
+    ReturnAddress = DAG.getCopyFromReg(DAG.getEntryNode(), DL, Reg, VT);
   }
 
-  // Return LR, which contains the return address. Mark it an implicit live-in.
-  unsigned Reg = MF.addLiveIn(AArch64::LR, &AArch64::GPR64RegClass);
-  return DAG.getCopyFromReg(DAG.getEntryNode(), DL, Reg, VT);
+  // The XPACLRI instruction assembles to a hint-space instruction before
+  // Armv8.3-A therefore this instruction can be safely used for any pre
+  // Armv8.3-A architectures. On Armv8.3-A and onwards XPACI is available so use
+  // that instead.
+  SDNode *St;
+  if (Subtarget->hasV8_3aOps()) {
+    St = DAG.getMachineNode(AArch64::XPACI, DL, VT, ReturnAddress);
+  } else {
+    // XPACLRI operates on LR therefore we must move the operand accordingly.
+    SDValue Chain =
+        DAG.getCopyToReg(DAG.getEntryNode(), DL, AArch64::LR, ReturnAddress);
+    St = DAG.getMachineNode(AArch64::XPACLRI, DL, VT, Chain);
+  }
+  return SDValue(St, 0);
 }
 
 /// LowerShiftRightParts - Lower SRA_PARTS, which returns two
 /// i64 values and take a 2 x i64 value to shift plus a shift amount.
 SDValue AArch64TargetLowering::LowerShiftRightParts(SDValue Op,
                                                     SelectionDAG &DAG) const {
   assert(Op.getNumOperands() == 3 && "Not a double-shift!");
   EVT VT = Op.getValueType();
   unsigned VTBits = VT.getSizeInBits();

llvm/test/CodeGen/AArch64/aarch64-signedreturnaddress.ll

+; RUN: llc < %s -mtriple=arm64-eabi -asm-verbose=false -mattr=v8.2a | FileCheck %s
+; RUN: llc < %s -mtriple=arm64-eabi -asm-verbose=false -mattr=v8.3a | FileCheck %s --check-prefix=CHECKV83
+
+; Armv8.3-A Pointer Authetication requires a special intsruction to strip the
+; pointer authentication code from the pointer.
+; The XPACLRI instruction assembles to a hint-space instruction before Armv8.3-A
+; therefore this instruction can be safely used for any pre Armv8.3-A architectures.
+; On Armv8.3-A and onwards XPACI is available so use that instead.
+
+define i8* @ra0() nounwind readnone {
+entry:
+; CHECK-LABEL: ra0:
+; CHECK-NEXT:     str     x30, [sp, #-16]!
+; CHECK-NEXT:     hint    #7
+; CHECK-NEXT:     mov     x0, x30
+; CHECK-NEXT:     ldr     x30, [sp], #16
+; CHECK-NEXT:     ret
+; CHECKV83:       str     x30, [sp, #-16]!
+; CHECKV83-NEXT:  xpaci   x30
+; CHECKV83-NEXT:  mov     x0, x30
+; CHECKV83-NEXT:  ldr     x30, [sp], #16
+; CHECKV83-NEXT:  ret
+  %0 = tail call i8* @llvm.returnaddress(i32 0)
+  ret i8* %0
+}
+
+define i8* @ra1() nounwind readnone #0 {
+entry:
+; CHECK-LABEL: ra1:
+; CHECK:          hint    #25
+; CHECK-NEXT:     str     x30, [sp, #-16]!
+; CHECK-NEXT:     hint    #7
+; CHECK-NEXT:     mov     x0, x30
+; CHECK-NEXT:     ldr     x30, [sp], #16
+; CHECK-NEXT:     hint    #29
+; CHECK-NEXT:     ret
+; CHECKV83:       paciasp
+; CHECKV83-NEXT:  str     x30, [sp, #-16]!
+; CHECKV83-NEXT:  xpaci   x30
+; CHECKV83-NEXT:  mov     x0, x30
+; CHECKV83-NEXT:  ldr     x30, [sp], #16
+; CHECKV83-NEXT:  retaa
+  %0 = tail call i8* @llvm.returnaddress(i32 0)
+  ret i8* %0
+}
+
+attributes #0 = { "sign-return-address"="all" }
+
+declare i8* @llvm.returnaddress(i32) nounwind readnone

llvm/test/CodeGen/AArch64/arm64-returnaddr.ll

 ; RUN: llc < %s -mtriple=arm64-eabi | FileCheck %s
 
 define i8* @rt0(i32 %x) nounwind readnone {
 entry:
 ; CHECK-LABEL: rt0:
+; CHECK: hint #7
 ; CHECK: mov x0, x30
 ; CHECK: ret
   %0 = tail call i8* @llvm.returnaddress(i32 0)
   ret i8* %0
 }
 
 define i8* @rt2() nounwind readnone {
 entry:
 ; CHECK-LABEL: rt2:
 ; CHECK: stp x29, x30, [sp, #-16]!
 ; CHECK: mov x29, sp
 ; CHECK: ldr x[[REG:[0-9]+]], [x29]
 ; CHECK: ldr x[[REG2:[0-9]+]], [x[[REG]]]
-; CHECK: ldr x0, [x[[REG2]], #8]
+; CHECK: ldr x30, [x[[REG2]], #8]
+; CHECK: hint #7
+; CHECK: mov x0, x30
 ; CHECK: ldp x29, x30, [sp], #16
 ; CHECK: ret
   %0 = tail call i8* @llvm.returnaddress(i32 2)
   ret i8* %0
 }
 
 declare i8* @llvm.returnaddress(i32) nounwind readnone

llvm/test/CodeGen/AArch64/arm64_32.ll

 ; CHECK-FAST: and x0, x30, #0xffffffff
   %val = call i8* @llvm.returnaddress(i32 0)
   ret i8* %val
 }
 
 define i8* @test_deep_returnaddr() {
 ; CHECK-LABEL: test_deep_returnaddr:
 ; CHECK: ldr x[[FRAME_REC:[0-9]+]], [x29]
-; CHECK-OPT: ldr x0, [x[[FRAME_REC]], #8]
+; CHECK-OPT: ldr x30, [x[[FRAME_REC]], #8]
+; CHECK-OPT: hint #7
+; CHECK-OPT: mov x0, x30
 ; CHECK-FAST: ldr [[TMP:x[0-9]+]], [x[[FRAME_REC]], #8]
 ; CHECK-FAST: and x0, [[TMP]], #0xffffffff
   %val = call i8* @llvm.returnaddress(i32 1)
   ret i8* %val
 }
 
 define void @test_indirect_call(void()* %func) {
 ; CHECK-LABEL: test_indirect_call:

llvm/test/CodeGen/AArch64/returnaddr.ll

 ; RUN: llc -o - %s -mtriple=arm64-apple-ios7.0 | FileCheck %s
 
 define i8* @rt0(i32 %x) nounwind readnone {
 entry:
 ; CHECK-LABEL: rt0:
+; CHECK: hint #7
 ; CHECK: mov x0, x30
   %0 = tail call i8* @llvm.returnaddress(i32 0)
   ret i8* %0
 }
 
 define i8* @rt2() nounwind readnone {
 entry:
 ; CHECK-LABEL: rt2:
 ; CHECK: ldr x[[reg:[0-9]+]], [x29]
 ; CHECK: ldr x[[reg]], [x[[reg]]]
-; CHECK: ldr x0, [x[[reg]], #8]
+; CHECK: ldr x30, [x[[reg]], #8]
+; CHECK: hint #7
+; CHECK: mov x0, x30
   %0 = tail call i8* @llvm.returnaddress(i32 2)
   ret i8* %0
 }
 
 declare i8* @llvm.returnaddress(i32) nounwind readnone